Data privacy watchdog issues first guidance document of its kind to mixed industry reception

Data privacy watchdog issues first guidance document of its kind to mixed industry reception

Leading data security experts today gave a mixed reception to the Information Commissioner’s Office (ICO) code of practice for the collection of personal data online.

Launching the ‘Personal information online code of practice’ – the first guidance document of its kind – the Information Commissioner, Christopher Graham, said: “The benefits of the internet age are clear: the chance to make more contacts, quicker transactions and greater convenience. But there are risks too. A record of our online activity can reveal our most personal interests. Get privacy right and you will retain the trust and confidence of your customers and users; mislead consumers or collect information you don’t need and you are likely to diminish customer trust and face enforcement action from the ICO.”

The ICO warned that keeping out of date records or not holding personal information securely help nobody and could result in enforcement action.

Guidelines given cautious welcome

Sean Sullivan, security adviser at software security experts F-Secure, commented: “The ICO’s policies and guidelines will help organisations define what’s mandatory or non-essential, and to label forms properly, but it doesn’t really help consumers understand. This is a business opportunity for those organisations that not only safeguard their customers’ information but also empower them with an understanding as to how it will be used. And that builds trust.”

Dave Everitt, Europe, Middle East and Africa general manager of Absolute Software, said: “The ICO’s new code of practice can only be a good thing, but it’s essential for organisations to understand what this means and how to remain compliant. When the ICO recently introduced data breach fines, almost half (45%) of IT directors polled by Absolute Software were not aware they had come into force and this can’t afford to happen again. Even more worrying is that of those who do know about the potential punishments, only 55% believe they will change their business practices as a result.

“After a run of high-profile data losses in the press, consumers have got to be able to feel they can trust businesses and public organisations with their personal details. How many more cases of lost laptops and vulnerable data will we see before organisations realise they have to do more to reassure the public?

“The ICO is absolutely right in publishing this code of practice, but it also needs to educate businesses so they understand they can take action to stop data loss if it ends up in the wrong hands. It doesn’t have to be a case of just hoping it doesn’t happen, businesses need to be more aware of who and what is available to help them avoid data breach. Burying their collective head in the sand simply won’t help.”